Tenant isolation for customer-facing analytics
Tenant isolation for customer-facing analytics means a SaaS backend verifies identity, derives tenant context, and applies that boundary to every chart, saved view, export, and AI question. QueryPanel’s headful React SDK renders a customer dashboard workspace with server-minted tenant-scoped JWTs; its headless Node SDK is the option for teams that need a fully custom UI and backend-controlled execution.
Must protect
Rows, metrics, saved views, exports, and AI-generated queries—not only the first chart load.
Trusted source
Your backend resolves the authenticated user and issues the tenant-scoped context.
Product choice
Use the headful React workspace for fastest launch; use headless for custom UI and backend-owned execution.
Principle
Tenant isolation is an authorization flow, not a dashboard filter
A filter can improve a dashboard, but it cannot prove who is allowed to see it. Safe analytics starts when your backend verifies the user and resolves the tenant; that same boundary must reach dashboard rendering, saved-chart execution, exports, and AI-generated SQL.
- Mint short-lived embed JWTs only after server-side tenant resolution.
- Treat the tenant boundary as input to generation and execution, not a browser-selected parameter.
- Test the same boundary in the initial dashboard, saved views, exports, and follow-up questions.
Failure modes
Where customer analytics leaks despite a correct-looking chart
Leaks appear when a system protects the first render but not the lifecycle around it. Frontend-only filters, reusable saved charts, editable parameters, exports, and broad AI questions can all bypass assumptions that looked safe in a demo.
QueryPanel approach
Choose a managed workspace or a custom execution boundary
QueryPanel’s primary path is a headful React SDK: embed a Notion-like customer dashboard workspace and let customers customize it with an AI assistant. The headless Node SDK is for teams that need their own interface and backend-controlled execution. In both paths, tenant identity starts on the server; customer-facing query rationale stays business-focused by default, while admins can opt into debugging detail.
FAQ
What is tenant isolation in analytics?
Tenant isolation means each customer can only query, view, and save analytics based on data they are authorized to access.
Are dashboard filters enough for tenant isolation?
No. Dashboard filters can help UX, but tenant authorization should be enforced through server-side identity, scoped query generation, database permissions, or another trusted backend control.
How does QueryPanel apply tenant isolation in an embedded dashboard?
Your backend resolves the authenticated tenant and mints a short-lived tenant-scoped JWT for the React embed. QueryPanel uses that server-issued context for the customer-facing analytics flow; the browser is not the source of tenant identity.